add debug printouts around id_token HMAC/RSA signature verification
fix skipping NULL JSON values
oops
improve session inactivity timeout handling

- set default session inactivity timeout to 300 seconds (was 900)
- enforce boundaries on inactivity timeout configuration setting: must
be between 10 and 86400 seconds (=24 hours)
- only update the session expiry once per minute - or once per 10% of
the inactivity timeout for timeouts < 600 seconds - to improve
performance cq. avoid writing the cache on every request